Allow ppid filtering on syscall auditing
Eric Paris
maintainerPATCH 1/1 Allow ppid filtering on syscall auditing
Currently ppid filtering on syscall auditing does not appear to work. An easy reproducer would be to do the following:
touch ./test
auditctl -a entry,always -S chmod -F ppid=[pid of your shell] chmod 000 ./test
no audit record will appear! (although !=[pid of your shell] will show all chmod commands from all processes regardless of the ppid)
With a little instrumentation I found that ctx->ppid == 0 inside audit_filter_rules(). I originally wanted to set the ppid during the context creation back in something like audit_alloc_context but that didn't work. Because at that point the new process had not forked off so the ppid of the chmod process was actually it's parents parents. Instead I set the ppid in audit_syscall_entry when we are actually building the specific context.
Please comment/ack/nak as soon as possible.
-Eric
kernel/auditsc.c | 1 + 1 file changed, 1 insertion(+)
kernel/auditsc.c renamed from kernel/auditsc.c.orig +1 -0
@@ -1116,6 +1116,7 @@ void audit_syscall_entry(int arch, int m context->arch = arch; context->major = major; + context->ppid =sys_getppid (); context->argv[0 ] = a1; context->argv[1 ] = a2; context->argv[2 ] = a3;
Quoted 28 lines · Eric Paris
Currently ppid filtering on syscall auditing does not appear to work. An easy reproducer would be to do the following:
touch ./test
auditctl -a entry,always -S chmod -F ppid=[pid of your shell] chmod 000 ./testno audit record will appear! (although !=[pid of your shell] will show all chmod commands from all processes regardless of the ppid)
With a little instrumentation I found that
ctx->ppid== 0 insideaudit_filter_rules(). I originally wanted to set the ppid during the context creation back in something likeaudit_alloc_contextbut that didn't work. Because at that point the new process had not forked off so the ppid of the chmod process was actually it's parents parents. Instead I set the ppid inaudit_syscall_entrywhen we are actually building the specific context.Please comment/ack/nak as soon as possible.
(quoted diff) +0
-1-Eric kernel/auditsc.c | 1 + 1 file changed, 1 insertion(+)
kernel/auditsc.c void audit_syscall_entry(int arch, int m · line 1119
Quoted 4 lines
kernel/auditsc.c renamed from kernel/auditsc.c.orig +1
-0@@ -1116,6 +1116,7 @@ void audit_syscall_entry(int arch, int m context->arch = arch; context->major = major; + context->ppid =sys_getppid ();
It looks like context->ppid is also being set in audit_log_exit(), which could overwrite the value assigned here. Should the one in audit_log_exit() be removed?
Quoted 9 lines
kernel/auditsc.c renamed from kernel/auditsc.c.orig +0
-1context->argv[0 ] = a1; context->argv[1 ] = a2; context->argv[2 ] = a3; --Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
Eric Paris
maintainerPATCH 1/1 -V2 Allow ppid filtering on syscall auditing
Currently ppid filtering on syscall auditing does not appear to work. An easy reproducer would be to do the following:
touch ./test
auditctl -a entry,always -S chmod -F ppid=[pid of your shell] chmod 000 ./test
no audit record will appear! (although !=[pid of your shell] will show all chmod commands from all processes regardless of the ppid)
With a little instrumentation I found that ctx->ppid == 0 inside audit_filter_rules(). I originally wanted to set the ppid during the context creation back in something like audit_alloc_context but that didn't work. Because at that point the new process had not forked off so the ppid of the chmod process was actually it's parents parents. Instead I set the ppid in audit_syscall_entry when we are actually building the specific context.
After some looking I did not see a way to get into audit_log_exit without having set the ppid. So I am dropping the set from there and only doing it at the beginning.
Please comment/ack/nak as soon as possible.
-Eric
kernel/auditsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/auditsc.c renamed from kernel/auditsc.c.orig +1 -1
@@ -795,7 +795,6 @@ static void audit_log_exit(struct audit_/* tsk == current */ context->pid = tsk->pid; - context->ppid =sys_getppid ();/* sic. tsk == current in all cases */ context->uid = tsk->uid; context->gid = tsk->gid; context->euid = tsk->euid;
@@ -1116,6 +1115,7 @@ void audit_syscall_entry(int arch, int m context->arch = arch; context->major = major; + context->ppid =sys_getppid (); context->argv[0 ] = a1; context->argv[1 ] = a2; context->argv[2 ] = a3;
Re: [PATCH] -V2 Allow ppid filtering on syscall auditing
Review void audit_syscall_entry(int arch, int m · line 1118
Quoted 11 lines · Eric Paris
After some looking I did not see a way to get into
audit_log_exitwithout having set the ppid. So I am dropping the set from there and only doing it at the beginning.Please comment/ack/nak as soon as possible.
(quoted diff) +1
-0@@ -1116,6 +1115,7 @@ void audit_syscall_entry(int arch, int m context->arch = arch; context->major = major; + context->ppid = sys_getppid();
Ehh... That's one hell of an overhead to be had ;-/ How about this?
kernel/auditsc.c +7 -2
@@ -278,8 +278,11 @@ static int audit_filter_rules(struct tas result =audit_comparator (tsk->pid, f->op, f->val);break ;case AUDIT_PPID : -if (ctx) +if (ctx) { +if (!ctx->ppid) + ctx->ppid =sys_getppid (); result =audit_comparator (ctx->ppid, f->op, f->val); + }break ;case AUDIT_UID : result =audit_comparator (tsk->uid, f->op, f->val);
@@ -795,7 +798,8 @@ static void audit_log_exit(struct audit_/* tsk == current */ context->pid = tsk->pid; - context->ppid =sys_getppid ();/* sic. tsk == current in all cases */ +if (!context->ppid) + context->ppid =sys_getppid (); context->uid = tsk->uid; context->gid = tsk->gid; context->euid = tsk->euid;
@@ -1132,6 +1136,7 @@ #endif context->ctime =CURRENT_TIME ; context->in_syscall =1 ; context->auditable = !!(state ==AUDIT_RECORD_CONTEXT ); + context->ppid =0 ; }/**